Information Systems Audit and Control
Association
www.isaca.org
Systems Audit and Control Association & Foundation
IT Control Objectives for Sarbanes-Oxley
The Importance of IT in the Design, Implementation and Sustainability of
Internal Control Over Disclosure and Financial Reporting
Appendices:
Company-level Questionnaire
IT Control Objectives
Purpose of IT Control Objectives for Sarbanes-Oxley
This research is intended as a reference for executive management and IT control professionals,
including IT management and assurance professionals, when evaluating an organization’s IT
controls as required by the US Sarbanes-Oxley Act of 2002 (the “Act”). These appendices are
being made available to ISACA members only, to facilitate their use. IT Control Objectives for
Sarbanes-Oxley is available in print through the ISACA bookstore for US $5. It is also posted on
the ISACA web site at www.isaca.org/research. Please be familiar with the guidance and
practices discussed in the document before using these appendices.
Information Systems Audit and Control Association
IT Governance Institute
The IT Governance Institute (www.itgi.org) was established in 1998 to advance international
thinking and standards in directing and controlling an enterprise’s information technology.
Effective IT governance helps ensure that IT supports business goals, optimizes business
investment in IT, and appropriately manages IT-related risks and opportunities. The IT
Governance Institute offers symposia, original research and case studies to assist enterprise
leaders and boards of directors in their IT governance responsibilities.
Information Systems Audit and Control Association®
With more than 35,000 members in more than 100 countries, the Information Systems Audit and
Control Association (ISACA®) (www.isaca.org) is a recognized worldwide leader in IT
governance, control, security and assurance. Founded in 1969, ISACA sponsors international
conferences, publishes the Information Systems Control Journal™, develops international
information systems auditing and control standards, and administers the globally respected
Certified Information Systems Auditor™ (CISA®) designation, earned by more than 35,000
professionals since inception, and the Certified Information Security Manager™ (CISM™)
designation, a groundbreaking credential earned by 5,000 professionals in its first two years.
© Copyright IT Governance Institute 2004 1
Disclaimer
The IT Governance Institute, Information Systems Audit and Control Association and other
contributors make no claim that use of the materials will assure a successful outcome. This
material should not be considered inclusive of IT controls, procedures and tests, or exclusive of
other IT controls, procedures and tests that may be reasonably present in an effective internal
control system over financial reporting. In determining the propriety of any specific control,
procedure or test, SEC registrants should apply appropriate judgment to the specific control
circumstances presented by the particular systems or information technology environment.
Readers should note that this material has not received endorsement from the SEC, the PCAOB
or any other standard-setting body. The issues that are dealt with in this publication will evolve
over time. Accordingly, companies should seek counsel and appropriate advice from their risk
advisors and/or auditors. The contributors make no representation or warranties and provide no
assurances that an organization’s use of this document will result in disclosure controls and
procedures and the internal controls and procedures for financial reporting that are compliant
with the requirements and the internal control reporting requirements of the Act, nor that an
organization’s plans will be sufficient to address and correct any shortcomings that would
prohibit the organization from making the required certification or reporting under the Act.
Internal controls, no matter how well designed and operated, can provide only reasonable
assurance of achieving an entity’s control objectives. The likelihood of achievement is affected
by limitations inherent to internal control. These include the realities that human judgment in
decision-making can be faulty and that breakdowns in internal control can occur because of
human failures such as simple errors or mistakes. Additionally, controls, whether manual or
automated, can be circumvented by the collusion of two or more people or inappropriate
management override of internal controls.
Disclosure
Copyright  2004 by the IT Governance Institute. Reproduction of selections of this publication
for academic use is permitted and must include full attribution of the material’s source.
Reproduction or storage in any form for commercial purpose is not permitted without ITGI’s
prior written permission. No other right or permission is granted with respect to this work.
Table of Contents
APPENDIX A—IT CONTROL OBJECTIVES FOR SARBANES-OXLEY
APPENDIX B—COMPANY-LEVEL QUESTIONNAIRE
APPENDIX C—IT CONTROL OBJECTIVES
IT GENERAL CONTROLS—PROGRAM DEVELOPMENT AND PROGRAM CHANGE
IT GENERAL CONTROLS—COMPUTER OPERATIONS AND ACCESS TO PROGRAMS AND DATA
APPLICATION CONTROLS—BUSINESS CYCLES
REFERENCES
© Copyright IT Governance Institute 2004 2
Appendix A—IT Control Objectives for Sarbanes-Oxley
The stage has been set for the importance of IT to prepare for Sarbanes-Oxley compliance, so the
focus now turns to the specific control objectives that will form the basis of an IT control
program.
Figure 10 illustrates the IT processes of COBIT and maps their relationship to the appropriate
COSO component. It is immediately evident that many COBIT IT processes have relationships
with more than one COSO component. This is expected given the nature of general IT controls
as they form the basis for achieving reliable information systems. This multiple relationship
attribute further demonstrates why IT controls are the basis for all others and are essential for a
reliable internal control program.
COBIT is a comprehensive framework for managing risk and control of IT, comprising four
domains, 34 IT processes and 318 detailed control objectives. COBIT includes controls that
address operational and compliance objectives, but only those related to financial reporting have
been used to develop this document.
While focus has been provided on what is required for financial reporting, the control objectives
and considerations set forth in this document may exceed what is necessary for organizations
seeking to comply with the requirements of the Sarbanes-Oxley Act. The suggested internal
control framework (COSO) to be used for compliance with the Sarbanes-Oxley Act, as
recommended by the SEC, addresses the topic of IT controls, but does not dictate requirements
for such control objectives and related control activities. Similarly, PCAOB Auditing Standard
No. 2 states the importance of IT controls, but does not specify which in particular must be
included. Such decisions remain the discretion of each organization. Accordingly, organizations
should assess the nature and extent of IT controls necessary to support their internal control
program on a case-by-case basis.
The reader may find the following materials particularly useful. This guide was not prepared to
suggest a one-size-fits-all approach; instead, it recommends that each organization tailor the
control objective template to fit its specific circumstances. For example, if systems development
is considered to be of low risk, an organization may choose to amend or delete some or all of the
suggested control objectives. An organization should also consult with its external auditors to
help ensure that all attestation-critical control objectives are addressed.
An important part of this publication is to provide guidance on the specific IT control objectives
that should be considered for compliance with COSO and, ultimately, the Sarbanes-Oxley Act.
Accordingly, the following section provides this information as well as a perspective on the
importance of the control segment and how it relates to COSO and financial disclosure controls.
As always, IT organizations should consider the nature and extent of their operations in
determining which of the control objectives, illustrative controls and tests of controls need to be
included in their internal control program.
© Copyright IT Governance Institute 2004 3
© Copyright IT Governance Institute 2004 4
Appendix B—Company-level Questionnaire
The following questionnaire provides a company-level assessment of an organization’s IT
control environment. This questionnaire includes COBIT control objectives found in the Plan and
Organize and Monitor and Evaluate domains and a few from the Deliver and Support domain. As
most organizations are using the COSO control framework for their internal control program,
this questionnaire has been structured in the same order as COSO.
Control Environment
The control environment creates the foundation for effective internal control, establishes the
“tone at the top,” and represents the apex of the corporate governance structure. The issues raised
in the control environment component apply throughout an IT organization.
Points to Consider
Responses
Comments
IT Strategic Planning
(1) Has management prepared strategic plans for IT that align
business objectives with IT strategies? Does the planning
approach include mechanisms to solicit input from
relevant internal and external stakeholders affected by the
IT strategic plans?
(2) Does management obtain feedback from business process
owners and users regarding the quality and usefulness of
its IT plans for use in the ongoing risk assessment
process?
(3) Does an IT planning or steering committee exist to
oversee the IT function and its activities? Does committee
membership include representatives from senior
management, user management and the IT function?
(4) Are IT strategies and ongoing operations formally
communicated to senior management and the board of
directors, e.g., through periodic meetings of an IT
steering committee?
(5) Does the IT organization ensure that IT plans are
communicated to business process owners and other
relevant parties across the organization?
(6) Does IT management communicate its activities,
challenges and risks on a regular basis with the CEO and
CFO? Is this information also shared with the board of
directors?
(7) Does the IT organization monitor its progress against the
strategic plan and react accordingly to meet established
objectives?
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
IT Organization and Relationships
(8) Do IT managers have adequate knowledge and
experience to fulfill their responsibilities?
(9) Have key systems and data been inventoried and their
owners identified?
(10) Are roles and responsibilities of the IT organization
defined, documented and understood?
© Copyright IT Governance Institute 2004 5
Points to Consider
(11) Do IT personnel have sufficient authority to exercise the
role and responsibility assigned to them?
(12) Do IT staff understand and accept their responsibility
regarding internal control?
(13) Have data integrity ownership and responsibilities been
communicated to appropriate data/business owners and
have they accepted these responsibilities?
(14) Is the IT organizational structure sufficient to provide for
necessary information flow to manage its activities?
(15) Has IT management implemented a division of roles and
responsibilities (segregation of duties) that reasonably
prevents a single individual from subverting a critical
process?
(16) Are IT staff evaluations performed regularly (e.g., to
ensure that the IT function has a sufficient number of
competent IT staff necessary to achieve objectives)?
(17) Are contracted staff and other contract personnel subject
to policies and procedures created to control their
activities by the IT function, and to assure the protection
of the organization’s information assets?
(18) Are significant IT events or failures, e.g., security
breaches, major system failures or regulatory failures,
reported to senior management or the board?
Responses
Comments
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Management of Human Resources
(19) Are controls in place to support appropriate and timely
responses to job changes and job terminations so that
internal controls and security are not impaired by such
occurrences?
(20) Does the IT organization subscribe to a philosophy of
continuous learning, providing necessary training and
skill development to its members?
(21) Has the IT organization adopted and promoted the
company’s culture of integrity management, including
ethics, business practices and human resources
evaluations?
Educate and Train Users
(22) Has the entity established procedures for identifying and
documenting the training needs of all personnel using
information services in support of the long-range plan?
(23) Does IT management provide education and ongoing
training programs that include ethical conduct, system
security practices, confidentiality standards, integrity
standards and security responsibilities of all staff?
© Copyright IT Governance Institute 2004 6
Information and Communication
COSO states that information is needed at all levels of an organization to run the business and
achieve the company’s control objectives. However, the identification, management and
communication of relevant information represents an ever-increasing challenge to the IT
department. The determination of which information is required to achieve control objectives
and the communication of this information in a form and time frame that allow people to carry
out their duties support the other four components of the COSO framework.
Points to Consider
Responses
Comments
Information Architecture
(24) Has IT management defined information capture,
processing and reporting controls—including
completeness, accuracy, validity and authorization—to
support the quality and integrity of information used for
financial and disclosure purposes?
(25) Has IT management defined information classification
standards in accordance with corporate security and
privacy policies?
(26) Has IT management defined, implemented and
maintained security levels for each of the data
classifications? Do these security levels represent the
appropriate (minimum) set of security and control
measures for each of the classifications? Are they
reevaluated periodically and modified accordingly?
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Communication of Management Aims and Directions
(27) Has IT management formulated, developed and
documented policies and procedures governing the IT
organization’s activities?
(28) Has IT management communicated policies and
procedures governing the IT organization’s activities?
(29) Does IT management periodically review its policies,
procedures and standards to reflect changing business
conditions?
(30) Does IT management have processes in place to
investigate compliance deviations and introduce remedial
action?
(31) Does IT management have a process in place to assess
compliance with its policies, procedures and standards?
(32) Does IT management understand its roles and
responsibilities related to the Sarbanes-Oxley Act?
© Copyright IT Governance Institute 2004 7
Risk Assessment
Risk assessment involves the identification and analysis by management of relevant risks to
achieve predetermined objectives, which form the basis for determining control activities. It is
likely that internal control risks could be more pervasive in the IT organization than in other
areas of the company. Risk assessment may occur at the company level (for the overall
organization) or at the activity level (for a specific process or business unit).
Points to Consider
Responses
Comments
Assessment of Risks
(33) Does the IT organization have an entity- and activitylevel risk assessment framework that is used periodically
to assess information risk to achieving business
objectives? Does it consider the probability and
likelihood of threats?
(34) Does the IT organization’s risk assessment framework
measure the impact of risks according to qualitative and
quantitative criteria, using inputs from different areas
including, but not limited to, management brainstorming,
strategic planning, past audits and other assessments?
(35) Is the IT organization’s risk assessment framework
designed to support cost-effective controls to mitigate
exposure to risks on a continuing basis, including risk
avoidance, mitigation or acceptance?
(36) Is a comprehensive security assessment performed for
critical systems and locations based on their relative
priority and importance to the organization?
(37) Where risks are considered acceptable, is there formal
documentation and acceptance of residual risk with
related offsets, including adequate insurance coverage,
contractually negotiated liabilities and self-insurance?
(38) Is the IT organization committed to active and continuous
risk assessment processes as an important tool in
providing information on the design and implementation
of internal controls, in the definition of the IT strategic
plan, and in the monitoring and evaluation mechanisms?
(39) Is access to the data center restricted to authorized
personnel, requiring appropriate identification and
authentication?
(40) Has a business impact assessment been performed that
considers the impact of systems failure on the financial
reporting process?
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Manage Facilities
(41) Are data center facilities equipped with adequate
environmental controls to maintain systems and data,
including fire suppression, uninterrupted power service
(UPS), air conditioning and elevated floors?
© Copyright IT Governance Institute 2004 8
Monitoring
Monitoring, which covers the oversight of internal control by management through continuous
and point-in-time assessment processes, is becoming increasingly important to IT management.
There are two types of monitoring activities: continuous monitoring and separate evaluations.
Points to Consider
Responses
Comments
Compliance With External Requirements
(42) Does the organization monitor changes in external
requirements for legal, regulatory or other external
requirements related to IT practices and controls?
(43) Are control activities in place and followed to ensure
compliance with external requirements, such as
regulatory and legal rules?
(44) Are internal events considered in a timely manner to
support continuous compliance with legal and regulatory
requirements?
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Management of Quality
(45) Is documentation created and maintained for all
significant IT processes, controls and activities?
(46) Does a plan exist to maintain the overall quality assurance
of IT activities based on the organizational and IT plans?
(47) Are documentation standards in place, have they been
communicated to all IT staff, and are they supported with
training?
(48) Does a quality plan exist for significant IT functions (e.g.,
system development and deployment) and does it provide
a consistent approach to address both general and projectspecific quality assurance activities?
(49) Does the quality plan prescribe the type(s) of quality
assurance activities (such as reviews, audits, inspections)
to be performed to achieve the objectives of the quality
plan?
(50) Does the quality assurance process include a review of
adherence to IT policies, procedures and standards?
(51) Have data integrity ownership and responsibilities been
communicated to the appropriate data owners and have
they accepted these responsibilities?
Manage Performance and Capacity
(52) Does IT management monitor the performance and
capacity levels of the systems and network?
(53) Does IT management have a process in place to respond
to suboptimal performance and capacity measures in a
timely manner?
(54) Is performance and capacity planning included in system
design and implementation activities?
Monitoring
(55) Have performance indicators (e.g., benchmarks) from
both internal and external sources been defined, and are
data being collected and reported regarding achievement
of these benchmarks?
© Copyright IT Governance Institute 2004 9
Points to Consider
(56) Has IT management established appropriate metrics to
effectively manage the day-to-day activities of the IT
department?
(57) Does IT management monitor IT’s delivery of services to
identify shortfalls and does IT respond with actionable
plans to improve?
Responses
Comments
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Yes
No
Comments:
Adequacy of Internal Control
(58) Does IT management monitor the effectiveness of
internal controls in the normal course of operations
through management and supervisory activities,
comparisons and benchmarks?
(59) Are serious deviations in the operation of internal control,
including major security, availability and processing
integrity events, reported to senior management?
(60) Are internal control assessments performed periodically,
using self-assessments or independent audits, to examine
whether or not internal controls are operating
satisfactorily?
Independent Assurance
(61) Does IT management obtain independent reviews prior to
implementing significant IT systems that are directly
linked to the organization’s financial reporting
environment?
(62) Does IT management obtain independent internal control
reviews of third-party service providers (e.g., by
obtaining and reviewing copies of SAS 70, SysTrust or
other independent audit reports)?
(63) Is documentation retained in a manner that can be used by
the independent auditor or examiner as a basis for
reliance?
Internal Audit
(64) Does the organization have an IT internal audit
department that is responsible for reviewing IT activities
and controls?
(65) Is the audit plan based upon a risk assessment that
includes IT? Does it cover the full range of IT audits, e.g.,
general and application controls, systems development
life cycle?
(66) Are procedures in place to follow up on IT control issues
in a timely manner?
© Copyright IT Governance Institute 2004 10
Appendix C—IT Control Objectives
IT General Controls—Program Development and Program Change
This domain considers procedures for acquiring and implementing new programs and systems,
as well as changes in, and maintenance of, existing systems to make sure that the life cycle is
continued for these systems. To realize the IT strategy, IT solutions need to be identified,
developed or acquired, as well as implemented and integrated into the business process.
COBIT control processes that should be considered for COSO internal control models include:
 Acquire or develop application software
 Acquire technology infrastructure
 Develop and maintain policies and procedures
 Install and test application software and technology infrastructure
 Manage changes
Each of these control processes is outlined in figures 11 through 15.
© Copyright IT Governance Institute 2004 11
Figure 11—Acquire or Develop Application Software
Control Guidance
Control Objective—Controls provide reasonable assurance that application and system software is
acquired or developed that effectively supports financial reporting requirements.
Rationale—Acquiring and maintaining software includes the design, acquisition/building and deployment of
systems that support the achievement of business objectives. This process includes major changes to existing
systems. This is where controls are designed and implemented to support initiating, recording, processing and
reporting financial information and disclosure. Deficiencies in this area may have a significant impact on
financial reporting and disclosure. For instance, without sufficient controls over application interfaces, financial
information may not be complete or accurate.
Illustrative Controls
The organization’s system development life cycle
methodology (SDLC) includes security, availability
and processing integrity requirements of the
organization.
The organization’s SDLC policies and procedures
consider the development and acquisition of new
systems and major changes to existing systems.
The SDLC methodology ensures that information
systems are designed to include application controls
that support complete, accurate, authorized and valid
transaction processing.
The organization has an acquisition and planning
process that aligns with its overall strategic direction.
IT management ensures that users are appropriately
involved in the design of applications, selection of
packaged software and the testing thereof, to ensure a
reliable environment.
Post-implementation reviews are performed to verify
controls are operating effectively.
The organization acquires/develops systems software
in accordance with its acquisition, development and
planning process.
Illustrative Tests of Controls
Obtain a copy of the organization’s SDLC
methodology. Review the methodology to determine
that it addresses security, availability and processing
integrity requirements. Consider whether there are
appropriate steps to ensure that these requirements are
considered throughout the development or acquisition
life cycle, e.g., security and availability and
processing integrity should be considered during the
requirements phase.
Review the organization’s SDLC methodology to
determine if it considers both the development and
acquisition of new systems and major changes to
existing systems.
Review the methodology to determine if it addresses
application controls. Consider whether there are
appropriate steps to ensure that application controls
are considered throughout the development or
acquisition life cycle, e.g., application controls should
be included in the conceptual design and detailed
design phases.
Review the SDLC methodology to ensure that the
organization’s overall strategic direction is considered,
e.g., an IT steering committee must review and
approve projects to ensure that a proposed project
aligns with strategic business requirements and that it
will utilize approved technologies.
Review the SDLC to determine if users are
appropriately involved in the design of applications,
selection of packaged software and testing.
Determine if post-implementation reviews are
performed on new systems and significant changes
reported.
Select a sample of projects that resulted in new
financial systems being implemented. Review the
documentation and deliverables from these projects to
determine if they have been completed in accordance
with the acquisition, development and planning
process.
© Copyright IT Governance Institute 2004 12
Figure 12—Acquire Technology Infrastructure
Control Guidance
Control Objective—Controls provide reasonable assurance that technology infrastructure is acquired so
that it provides the appropriate platforms to support financial reporting applications.
Rationale—Acquiring and maintaining technology infrastructure includes the design, acquisition/building and
deployment of systems that support applications and communications. Infrastructure components, including
servers, networks and databases, are critical for secure and reliable information processing. Without an
adequate infrastructure there is an increased risk that financial reporting applications will not be able to pass
data between applications, financial reporting applications will not operate, and critical infrastructure failures
will not be detected in a timely manner.
Illustrative Controls
Illustrative Tests of Controls
Documented procedures exist and are followed to
ensure that infrastructure systems, including network
devices and software, are acquired based on the
requirements of the financial applications they are
intended to support.
Select a sample of technology infrastructure
implementations. Review the documentation and
deliverables from these projects to determine if
infrastructure requirements were considered at the
appropriate time during the acquisition process.
Figure 13—Develop and Maintain Policies and Procedures
Control Guidance
Control Objective—Controls provide reasonable assurance that policies and procedures that define
required acquisition and maintenance processes have been developed and are maintained, and that they
define the documentation needed to support the proper use of the applications and the technological
solutions put in place.
Rationale—Policies and procedures include the SDLC methodology, the process for acquiring, developing
and maintaining applications, as well as required documentation. For some organizations they include service
level agreements, operational practices and training materials. Policies and procedures support an
organization’s commitment to perform business process activities in a consistent and objective manner.
Illustrative Controls
Illustrative Tests of Controls
The organization’s SDLC methodology and associated
policies and procedures are regularly reviewed, updated
and approved by management.
Confirm that the organization’s policies and
procedures are regularly reviewed and updated as
changes in the environment dictate. When
policies and procedures are changed, determine if
management approves such changes.
The organization ensures that its systems and
applications are developed in accordance with its
supported, documented policies and procedures.
Select a sample of projects and determine that
user reference and support manuals and systems
documentation and operations documentation
were prepared. Consider whether drafts of these
manuals were incorporated in user acceptance
testing. Determine whether any changes to
proposed controls resulted in documentation
updates.
Review a sample of application documentation
(including user manuals) to determine if they
comply with the policies and procedures that have
been documented by the organization.
© Copyright IT Governance Institute 2004 13
Figure 14—Install and Test Application Software and Technology Infrastructure
Control Guidance
Control Objective—Controls provide reasonable assurance that the systems are appropriately tested and
validated prior to being placed into production processes and associated controls operate as intended and
support financial reporting requirements.
Rationale—Installation testing and validating relate to the migration of new systems into production. Before such
systems are installed, appropriate testing and validation must be performed to ensure that systems are operating as
designed. Without adequate testing, systems may not function as intended and may provide invalid information,
which could result in unreliable financial information and reports.
Illustrative Controls
A testing strategy is developed and followed for all
significant changes in applications and infrastructure
technology, which addresses unit-, system-,
integration- and user-acceptance level testing to help
ensure that deployed systems operate as intended.
Load and stress testing is performed according to a test
plan and established testing standards.
Interfaces with other systems are tested to confirm that
data transmissions are complete, accurate and valid.
The conversion of data is tested between its origin and
its destination to confirm that it is complete, accurate
and valid.
Illustrative Tests of Controls
Select a sample of system development projects and
significant system upgrades (including technology
upgrades). Determine if a formal testing strategy was
prepared and followed. Consider whether this strategy
considered potential development and implementation
risks and addressed all the necessary components to
address these risks, e.g., if the completeness and accuracy
of system interfaces were essential to the production of
complete and accurate reporting, these interfaces were
included in the testing strategy.
(Note: controls over the final move to production are
addressed in the Manage Changes figure 15.)
Select a sample of system development projects and
significant system upgrades that are significant for
financial reporting. Where it was considered that capacity
and performance were of potential concern, review the
approach to load and stress testing. Consider whether a
structured approach was taken to load and stress testing
and that the approach taken adequately modeled the
anticipated volumes, including types of transactions being
processed and the impact on performance of other services
that would be running concurrently.
Select a sample of system development projects and
significant system upgrades that are significant for
financial reporting. Determine if interfaces with other
systems were tested to confirm that data transmissions are
complete, e.g., record totals are accurate and valid.
Consider whether the extent of testing was sufficient and
included recovery in the event of incomplete data
transmissions.
Obtain a sample of system development projects and
significant system upgrades that are significant for
financial reporting. Determine if a conversion strategy was
documented. Consider whether it included strategies to
“scrub” the data in the old system before conversion or to
“run down” data in the old system before conversion.
Review the conversion testing plan. Consider whether the
following were considered: data transformations, input of
data not available in the old system, edits, completeness
controls and timing of conversions. Determine if the
conversion was included in acceptance testing and was
approved by user management.
© Copyright IT Governance Institute 2004 14
Figure 15—Manage Changes
Control Guidance
Control Objective—Controls provide reasonable assurance that system changes of financial reporting
significance are authorized and appropriately tested before being moved to production.
Rationale—Managing changes addresses how an organization modifies system functionality to help the business
meet its financial reporting objectives. Deficiencies in this area could significantly impact financial reporting. For
instance, changes to the programs that allocate financial data to accounts require appropriate approvals and testing
prior to the change to ensure classification and reporting integrity.
Illustrative Controls
Requests for program changes, system changes and
maintenance (including changes to system software)
are standardized, documented and subject to formal
change management procedures.
Illustrative Tests of Controls
Determine that a documented change management
process exists and is maintained to reflect the current
process.
Consider if change management procedures exist for all
changes to the production environment, including
program changes, system maintenance and infrastructure
changes.
Evaluate the process used to control and monitor change
requests.
Consider whether change requests are properly initiated,
approved and tracked.
Determine whether program change is performed in a
segregated, controlled environment.
Select a sample of changes made to applications/systems
to determine whether they were adequately tested and
approved before being placed into a production
environment. Establish if the following are included in
the approval process: operations, security, IT
infrastructure management and IT management.
Evaluate procedures designed to ensure only authorized/
approved changes are moved into production.
Trace the sample of changes back to the change request
log and supporting documentation.
Emergency change requests are documented and
subject to formal change management procedures.
Confirm that these procedures address the timely
implementation of patches to system software. Select a
sample to determine compliance with the documented
procedures.
Determine if a process exists to control and supervise
emergency changes.
Determine if an audit trail exists of all emergency activity
and that it is independently reviewed.
Determine that procedures require that emergency
changes be supported by appropriate documentation.
© Copyright IT Governance Institute 2004 15
Establish that backout procedures are developed for
emergency changes.
Controls are in place to restrict migration of programs
to production only by authorized individuals.
IT management ensures that the setup and
implementation of system software do not jeopardize
the security of the data and programs being stored on
the system.
Evaluate procedures ensuring that all emergency changes
are tested and subject to standard approval procedures
after they have been made. Review a sample of changes
that are recorded as “emergency” changes, and determine
if they contain the needed approval and the needed access
was terminated after a set period of time. Establish that
the sample of changes was well documented.
Evaluate the approvals required before a program is
moved to production. Consider approvals from system
owners, development staff and computer operations.
Confirm that there is appropriate segregation of duties
between the staff responsible for moving a program into
production and development staff. Obtain and test
evidence to support this assertion.
Determine that a risk assessment of the potential impact
of changes to system software is performed. Review
procedures to test changes to system software in a
development environment before they are applied to
production. Verify that backout procedures exist.
IT General Controls—Computer Operations and Access to Programs and Data
This domain considers procedures for the actual delivery of required services, which range from
traditional operations to security and access management. To deliver services, the necessary
support processes must be set up.
COBIT control processes that should be considered for COSO internal control models include:
 Define and manage service levels
 Manage third-party services
 Ensure systems security
 Manage the configuration
 Manage problems and incidents
 Manage data
 Manage operations
Each of these control processes is outlined in figures 16 through 22.
© Copyright IT Governance Institute 2004 16
Figure 16—Define and Manage Service Levels
Control Guidance
Control Objective—Controls provide reasonable assurance that service levels are defined and managed
in a manner that satisfies financial reporting system requirements and provides a common
understanding of performance levels with which the quality of services will be measured.
Rationale—The process of defining and managing service levels addresses how an organization meets the
functional and operational expectations of its users and, ultimately, the objectives of the business. Roles and
responsibilities are defined and an accountability and measurement model is used to ensure services are
delivered as required. Deficiencies in this area could significantly impact financial reporting and disclosure of
an entity. For instance, if systems are poorly managed or system functionality is not delivered as required,
financial information may not be processed as intended.
Illustrative Controls
Illustrative Tests of Controls
Service levels are defined and managed to support
Obtain a sample of service level agreements and
financial reporting system requirements.
review their content for clear definition of service
descriptions and expectations of users.
Discuss with members of the organization responsible
for service level management and test evidence to
determine whether service levels are actively
managed.
Obtain and test evidence that service levels are being
actively managed in accordance with service level
agreements.
A framework is defined to establish key
performance indicators to manage service level
agreements, both internally and externally.
Discuss with users whether financial reporting systems
are being supported and delivered in accordance with
their expectations and service level agreements.
Obtain service level performance reports and confirm
that they include key performance indicators.
Review the performance results, identify performance
issues and assess how service level managers are
addressing these issues.
© Copyright IT Governance Institute 2004 17
Figure 17—Manage Third-party Services
Control Guidance
Control Objective—Controls provide reasonable assurance that third-party services are secure,
accurate and available, support processing integrity and defined appropriately in performance
contracts.
Rationale—Managing third-party services includes the use of outsourced service providers to support
financial applications and related systems. Deficiencies in this area could significantly impact financial
reporting and disclosure of an entity. For instance, insufficient controls over processing accuracy by a thirdparty service provider may result in inaccurate financial results.
Illustrative Controls
A designated individual is responsible for regular
monitoring and reporting on the achievement of the
third-party service level performance criteria.
Selection of vendors for outsourced services is
performed in accordance with the organization’s
vendor management policy.
IT management determines that, before selection,
potential third parties are properly qualified through
an assessment of their capability to deliver the
required service and a review of their financial
viability.
Third-party service contracts address the risks,
security controls and procedures for information
systems and networks in the contract between the
parties.
Procedures exist and are followed to ensure that a
formal contract is defined and agreed for all thirdparty services before work is initiated, including
definition of internal control requirements and
acceptance of the organization’s policies and
procedures.
A regular review of security, availability and
processing integrity is performed for service level
agreements and related contracts with third-party
service providers.
Illustrative Tests of Controls
Determine if the management of third-party services
has been assigned to appropriate individuals.
Obtain the organization’s vendor management policy
and discuss with those responsible for third-party
service management if they follow such standards.
Obtain and test evidence that the selection of vendors
for outsourced services is performed in accordance
with the organization’s vendor management policy.
Obtain the criteria and business case used for selection
of third-party service providers.
Assess whether these criteria include a consideration
of the third party’s financial stability, skill and
knowledge of the systems under management, and
controls over security, availability and processing
integrity.
Select a sample of third-party service contracts and
determine if they include controls to support security,
availability and processing integrity in accordance
with the company’s policies and procedures.
Review a sample of contracts and determine whether:
 There is a definition of services to be performed.
 The responsibilities for the controls over financial
reporting systems have been adequately defined.
 The third party has accepted compliance with the
organization’s policies and procedures, e.g.,
security policies and procedures.
 The contracts were reviewed and signed by
appropriate parties before work commenced.
 The controls over financial reporting systems and
subsystems described in the contract agree with
those required by the organization.
Review gaps, if any, and consider further analysis to
determine the impact on financial reporting.
Inquire whether third-party service providers perform
independent reviews of security, availability and
processing integrity, e.g., service auditor report.
Obtain a sample of the most recent review and
determine if there are any control deficiencies that
would impact financial reporting.
© Copyright IT Governance Institute 2004 18
Figure 18—Ensure Systems Security
Control Guidance
Control Objective—Controls provide reasonable assurance that financial reporting systems and
subsystems are appropriately secured to prevent unauthorized use, disclosure, modification, damage or
loss of data.
Rationale—Managing systems security includes both physical and logical controls that prevent unauthorized
access. These controls typically support authorization, authentication, nonrepudiation, data classification and
security monitoring. Deficiencies in this area could significantly impact financial reporting. For instance,
insufficient controls over transaction authorization may result in inaccurate financial reporting.
Illustrative Controls
An information security policy exists and has been
approved by an appropriate level of executive
management.
A framework of security standards has been developed
that supports the objectives of the security policy.
An IT security plan exists that is aligned with overall IT
strategic plans.
The IT security plan is updated to reflect changes in the
IT environment as well as security requirements of
specific systems.
Illustrative Tests of Controls
Obtain a copy of the organization’s security
policy and evaluate the effectiveness. Points to be
taken into consideration include:
 Is there an overall statement of the
importance of security to the organization?
 Have specific policy objectives been defined?
 Have employee and contractor security
responsibilities been addressed?
 Has the policy been approved by an
appropriate level of senior management to
demonstrate management’s commitment to
security?
 Is there a process to communicate the policy
to all levels of management and employees?
Obtain a copy of the security standards. Determine
whether the standards framework effectively meets
the objectives of the security policy. Consider
whether the following topics, which are often
addressed by security standards, have been
appropriately covered:
 Security organization
 Asset classification and control
 Personnel security
 Software security policy
 Physical and environmental security
 Workstation security
 Computing environment management
 Network environment management
 System access control
 Business continuity planning
 Compliance
 System development and maintenance
Determine if there are processes in place to
communicate and maintain these standards.
Obtain a copy of security plans or strategies for
financial reporting systems and subsystems and
assess their adequacy in relation to the overall
company plan.
Confirm that the security plan reflects the unique
security requirements of financial reporting
systems and subsystems.
© Copyright IT Governance Institute 2004 19
Control Guidance
Procedures exist and are followed to authenticate all
users to the system to support the validity of
transactions.
Assess the authentication mechanisms used to
validate user credentials for financial reporting
systems and subsystems and validate that user
sessions time-out after a predetermined period of
time.
Procedures exist and are followed to maintain the
Review security practices to confirm that
effectiveness of authentication and access mechanisms
authentication controls (passwords, IDs, two(e.g., regular password changes).
factor, etc.) are used appropriately and are subject
to common confidentiality requirements (IDs and
passwords not shared, alphanumeric passwords
used, etc.).
Procedures exist and are followed to ensure timely action Confirm that procedures exist for the registration,
relating to requesting, establishing, issuing, suspending
change and deletion of users from financial
and closing user accounts.
reporting systems and subsystems on a timely
basis and the procedures are followed.
Validate that attempts to gain unauthorized access
to financial reporting systems and subsystems are
logged and are followed up on a timely basis.
Select a sample of new users and determine if
management approved their access and the access
granted agrees with the access privileges that
were approved.
Select a sample of terminated employees and
determine if their access has been removed, and
was done in a timely manner.
A control process exists and is followed to periodically
review and confirm access rights.
Where appropriate, controls exist to ensure that neither
party can deny transactions and controls are
implemented to provide nonrepudiation of origin or
receipt, proof of submission and receipt of transactions.
Select a sample of current users and review their
access for appropriateness based upon their job
functions.
Inquire whether access controls are reviewed for
financial reporting systems and subsystems on a
periodic basis by management.
Assess the adequacy of how exceptions are
reexamined, and if the follow-up occurs in a
timely manner.
Determine how the organization establishes
accountability for transaction initiation and
approval.
Test the use of accountability controls by
observing a user attempting to enter an
unauthorized transaction.
Obtain a sample of transactions, and identify
evidence of the accountability or origination of
each.
Where network connectivity is used, appropriate
controls, including firewalls, intrusion detection and
Determine the sufficiency and appropriateness of
perimeter security controls including firewalls and
© Copyright IT Governance Institute 2004 20
Control Guidance
vulnerability assessments, exist and are used to prevent
unauthorized access.
intrusion detection systems.
Inquire whether management has performed an
independent assessment of controls within the
past year (e.g., ethical hacking, social
engineering).
Obtain a copy of this assessment and review the
results, including the appropriateness of follow-up
on identified weaknesses.
Determine if antivirus systems are used to protect
the integrity and security of financial reporting
systems and subsystems.
IT security administration monitors and logs security
activity, and identified security violations are reported to
senior management.
Controls relating to appropriate segregation of duties
over requesting and granting access to systems and data
exist and are followed.
Access to facilities is restricted to authorized personnel
and requires appropriate identification and
authentication.
When appropriate, determine if encryption
techniques are used to support the confidentiality
of financial information sent from one system to
another.
Inquire whether a security office exists to monitor
for security vulnerabilities and related threat
events.
Assess the nature and extent of such events over
the past year and discuss with management how
they have responded with controls to prevent
unauthorized access or manipulation of financial
systems and subsystems.
Review the process to request and grant access to
systems and data and confirm that the same
person does not perform these functions.
Obtain polices and procedures as they relate to
facility security, key and card reader access—and
determine if those procedures account for proper
identification and authentication.
Observe the in and out traffic to the organization’s
facilities to establish that proper access is
controlled.
Select a sample of users and determine if their
access is appropriate based upon their job
responsibilities.
© Copyright IT Governance Institute 2004 21
Figure 19—Manage the Configuration
Control Guidance
Control Objective—Controls provide reasonable assurance that all IT components, as they relate to
security, processing and availability, are well protected, would prevent any unauthorized changes, and
assist in the verification and recording of the current configuration.
Rationale—Configuration management ensures that security, availability and processing integrity controls are
set up in the system and maintained through its life cycle. Insufficient configuration controls can lead to
security and availability exposures that may permit unauthorized access to systems and data and impact
financial reporting.
Illustrative Controls
Illustrative Tests of Controls
Only authorized software is permitted for use by
Determine if procedures are in place to detect and
employees using company IT assets.
prevent the use of unauthorized software. Obtain
and review the company policy as it relates to
software use to see that this is clearly articulated.
System infrastructure, including firewalls, routers,
switches, network operating systems, servers and other
related devices, is properly configured to prevent
unauthorized access.
Application software and data storage systems are
properly configured to provision access based on the
individual’s demonstrated need to view, add, change or
delete data.
Consider reviewing a sample of applications and
computers to determine if they are in
conformance with organization policy.
Determine if the organization’s policies require
the documentation of the current configuration, as
well as the security configuration settings to be
implemented.
Review a sample of servers, firewalls, routers,
etc., to consider if they have been configured in
accordance with the organization’s policy.
Conduct an evaluation of the frequency and
timeliness of management’s review of
configuration records.
Assess whether management has documented the
configuration management procedures.
IT management has established procedures across the
organization to protect information systems and
technology from computer viruses.
Periodic testing and assessment is performed to confirm
that the software and network infrastructure is
appropriately configured.
Review a sample of configuration changes,
additions or deletions, to consider if they have
been properly approved based on a demonstrated
need.
Review the organization’s procedures to detect
computer viruses.
Verify that the organization has installed and is
using virus software on its networks and personal
computers.
Review the software and network infrastructure to
establish that it has been appropriately configured
and maintained, according to the organization’s
documented process.
© Copyright IT Governance Institute 2004 22
Figure 20—Manage Problems and Incidents
Control Guidance
Control Objective—Controls provide reasonable assurance that any problems and/or incidents are
properly responded to, recorded, resolved or investigated for proper resolution.
Rationale—Managing problems and incidents addresses how an organization identifies, documents and
responds to events that fall outside of normal operations. Deficiencies in this area could significantly impact
financial reporting.
Illustrative Controls
Illustrative Tests of Controls
IT management has defined and implemented a
problem management system to ensure that
operational events that are not part of standard
operation (incidents, problems and errors) are
recorded, analyzed and resolved in a timely manner.
The problem management system provides for
adequate audit trail facilities, which allow tracing from
incident to underlying cause.
A security incident response process exists to support
timely response and investigation of unauthorized
activities.
Determine if a problem management system exists,
and how it is being used. Review how management
has documented how the system is to be used.
Review a sample of problem or incident reports, to
consider if the issues were addressed (recorded,
analyzed and resolved) in a timely manner.
Determine if the organization’s procedures include
audit trail facilities—tracking of the incidents.
Review a sample of problems recorded on the
problem management system to consider if a proper
audit trail exists and is used.
Verify that all unauthorized activities are responded
to in a timely fashion, and there is a process to
support proper disposition.
Figure 21—Manage Data
Control Guidance
Control Objective—Controls provide reasonable assurance that data recorded, processed and reported
remain complete, accurate and valid throughout the update and storage process.
Rationale—Managing data includes the controls and procedures used to support information integrity,
including its completeness, accuracy, authorization and validity. Controls are designed to support initiating,
recording, processing and reporting financial information. Deficiencies in this area could significantly impact
financial reporting. For instance, without appropriate authorization controls over the initiation of transactions,
resulting financial information may not be reliable.
Illustrative Controls
Policies and procedures exist for the handling,
distribution and retention of data and reporting
output.
Illustrative Tests of Controls
Review the policies and procedures for the handling,
distribution and retention of data and reporting output.
Determine whether the policies and procedures are
adequate for the protection of data and the timely
distribution of all the correct financial reports
(including electronic reports) to appropriate personnel.
Obtain and test evidence that the controls over the
protection of data and the timely distribution of
financial reports (including electronic reports) to
appropriate personnel are operating effectively.
© Copyright IT Governance Institute 2004 23
Control Guidance
Management protects sensitive information,
logically and physically, in storage and during
transmission against unauthorized access or
modification.
Retention periods and storage terms are defined for
documents, data, programs, reports and messages
(incoming and outgoing), as well as the data (keys,
certificates) used for their encryption and
authentication.
Review the results of security testing. Determine if
there are adequate controls to protect sensitive
information, both logically and physically, in storage
and during transmission against unauthorized access
or modification.
Obtain the procedures dealing with distribution and
retention of data.
Confirm that the procedures define the retention
periods and storage terms for documents, data,
programs, reports and messages (incoming and
outgoing), as well as the data (keys, certificates) used
for their encryption and authentication.
Confirm that the retention periods are in conformity
with the Sarbanes-Oxley Act.
Management has implemented a strategy for
cyclical backup of data and programs.
Procedures exist and are followed to periodically
test the effectiveness of the restoration process and
the quality of backup media.
Confirm that the retention periods of previously
archived material are in conformity with the SarbanesOxley Act. Select a sample of archived material and
test evidence that archived material is being archived
in conformance with the requirements of the SarbanesOxley Act.
Determine if the organization has procedures in place
to back up data and programs based on IT and user
requirements. Select a sample of data files and
programs and determine if they are being backed up as
required.
Inquire whether the retention and storage of messages,
documents, programs, etc., have been tested during the
past year.
Obtain and review the results of testing activities.
Changes to data structures are authorized, made in
accordance with design specifications and
implemented in a timely manner.
Establish whether any deficiencies were noted and
whether they have been reexamined. Obtain the
organization’s access security policy and discuss with
those responsible whether they follow such standards
and guidelines dealing with sensitive backup data.
Obtain a sample of data structure changes and
determine whether they adhere to the design
specifications and were implemented in the time
frame required.
© Copyright IT Governance Institute 2004 24
Figure 22—Manage Operations
Control Guidance
Control Objective—Controls provide reasonable assurance that authorized programs are executed as
planned and deviations from scheduled processing are identified and investigated, including controls
over job scheduling, processing, error monitoring and system availability.
Rationale—Managing operations addresses how an organization maintains reliable application systems in
support of the business to initiate, record, process and report financial information. Deficiencies in this area
could significantly impact an entity’s financial reporting. For instance, lapses in the continuity of application
systems may prevent an organization from recording financial transactions and thereby undermine its integrity.
Illustrative Controls
Illustrative Tests of Controls
Management has established and documented standard Determine if management has documented its
procedures for IT operations, including scheduling,
procedures for IT operations, and operations are
managing, monitoring and responding to security,
reviewed periodically to ensure compliance.
availability and processing integrity events.
Review a sample of events to confirm that response
procedures are operating effectively. When used,
review the job scheduling process and the
procedures in place to monitor job completeness.
System event data are sufficiently retained to provide
Determine if sufficient chronological information is
chronological information and logs to enable the
being recorded and stored in logs, and it is useable
review, examination and reconstruction of system and
for reconstruction, if necessary. Obtain a sample of
data processing.
the log entries, to determine if they sufficiently
allow for reconstruction.
System event data are designed to provide reasonable
Inquire as to the type of information that is used by
assurance as to the completeness and timeliness of
management to verify the completeness and
system and data processing.
timeliness of system and data processing.
End-user computing policies and procedures
concerning security, availability and processing
integrity exist and are followed.
End-user computing, including spreadsheets and other
user-developed programs, are documented and
regularly reviewed for processing integrity, including
their ability to sort, summarize and report accurately.
User-developed systems and data are regularly backed
up and stored in a secure area.
Review a sample of system processing event data to
confirm the completeness and timeliness of
processing.
Obtain a copy of the end-user computing policies
and procedures and confirm that they address
security, availability and processing integrity
controls.
Select a sample of users and inquire whether they
are aware of this policy and if they are in
compliance with it.
Inquire as to management’s knowledge of end-user
programs in use across the company.
Inquire as to the frequency and approaches followed
to review end-user programs for processing
integrity, and review a sample of these to confirm
effectiveness.
Review user-developed systems and test their ability
to sort, summarize and report in accordance with
management intentions.
Inquire how end-user systems are backed up and
where they are stored.
© Copyright IT Governance Institute 2004 25
Control Guidance
User-developed systems, such as spreadsheets and
other end-user programs, are secured from
unauthorized use.
Review the security used to protect unauthorized
access to user-developed systems.
Consider observing a user attempting to gain
unauthorized access to user-developed systems.
Access to user-developed systems is restricted to a
limited number of users.
Inputs, processing and outputs from user-developed
systems are independently verified for completeness
and accuracy.
Inquire how management is able to detect
unauthorized access and what follow-up procedures
are performed to assess the impact of such access.
Select a sample of user-developed systems and
determine who has access and if the access is
appropriate.
Inquire how management verifies the accuracy and
completeness of information processed and reported
from user-developed systems.
Inquire who reviews and approves outputs from
user-developed systems prior to their submission for
further processing or final reporting.
Consider reperforming or reviewing the logic used
in user-developed systems and conclude on its
ability to process completely and accurately.
Application Controls—Business Cycles
Application controls apply to the business processes they support. They are controls designed
within the application to prevent or detect unauthorized transactions. When combined with
manual controls, as necessary, application controls ensure completeness, accuracy, authorization
and validity of processing transactions.
For the most part, control objectives presented in the following figures can be enabled through
the use of built-in application control functionality. This functionality is commonly found in
integrated ERP environments, such as SAP, PeopleSoft, Oracle, JD Edwards and others. Where
this functionality does not exist, these control objectives may require a combination of manual
and automated control procedures to satisfy the control objective.
The control objectives presented below should not be considered an exhaustive list, but rather an
example of controls that are commonly enabled by application systems. Organizations should
consider what additional control objectives are required based on their particular industry and
operating environment.
Figures 23-27 refer to controls that extend into applications and business processes that
contribute to completeness, accuracy, validity and authorization controls.
© Copyright IT Governance Institute 2004 26
Figure 23—Application Control Objectives for the Sales Cycle
Illustrative Control Objectives
Orders are processed only within approved customer credit limits.
Orders are approved by management as to prices and terms of sale.
Orders and cancellations of orders are input accurately.
Order entry data are transferred completely and accurately to the shipping
and invoicing activities.
All orders received from customers are input and processed.
Financial Statement Assertions
Valuation
Validity
Valuation
Valuation
Completeness
Completeness
Only valid orders are input and processed.
Validity
Invoices are generated using authorized terms and prices.
Valuation
Invoices are accurately calculated and recorded.
Valuation
Credit notes and adjustments to accounts receivable are accurately
calculated and recorded.
Valuation
All goods shipped are invoiced.
Completeness
Credit notes for all goods returned and adjustments to accounts receivable
are issued in accordance with organization policy.
Validity
Invoices relate to valid shipments.
Validity
All credit notes relate to a return of goods or other valid adjustments.
Completeness
All invoices issued are recorded.
Completeness
All credit notes issued are recorded.
Validity
Invoices are recorded in the appropriate period.
Valuation
Occurrence
Credit notes issued are recorded in the appropriate period.
Valuation
Occurrence
Cash receipts are recorded in the period in which they are received.
Valuation
Occurrence
Cash receipts data are entered for processing accurately.
Valuation
All cash receipts data are entered for processing.
Validity
Cash receipts data are valid and are entered for processing only once.
Completeness
© Copyright IT Governance Institute 2004 27
Illustrative Control Objectives
Financial Statement Assertions
Cash discounts are accurately calculated and recorded.
Valuation
Timely collection of accounts receivable is monitored.
Valuation
The customer master file is maintained.
Completeness
Validity
Only valid changes are made to the customer master file.
Completeness
Validity
All valid changes to the customer master file are input and processed.
Completeness
Validity
Changes to the customer master file are accurate.
Valuation
Changes to the customer master file are processed in a timely manner.
Completeness
Validity
Customer master file data remain up-to-date.
Completeness
Validity
Figure 24—Application Control Objectives for the Purchasing Cycle
Illustrative Control Objectives
Financial Statement Assertions
Purchase orders are placed only for approved requisitions.
Validity
Purchase orders are accurately entered.
Valuation
All purchase orders issued are input and processed.
Completeness
Amounts posted to accounts payable represent goods or services received.
Validity
Accounts payable amounts are accurately calculated and recorded.
Valuation
All amounts for goods or services received are input and processed to
accounts payable.
Completeness
Amounts for goods or services received are recorded in the appropriate
period.
Valuation
Occurrence
Accounts payable are adjusted only for valid reasons.
Completeness
Validity
Credit notes and other adjustments are accurately calculated and recorded.
Valuation
All valid credit notes and other adjustments related to accounts payable are
input and processed.
Completeness
Validity
Credit notes and other adjustments are recorded in the appropriate period.
Valuation
Occurrence
Disbursements are made only for goods and services received.
Validity
© Copyright IT Governance Institute 2004 28
Illustrative Control Objectives
Financial Statement Assertions
Disbursements are distributed to the appropriate suppliers.
Validity
Disbursements are accurately calculated and recorded.
Valuation
All disbursements are recorded.
Completeness
Disbursements are recorded in the period in which they are issued.
Valuation
Occurrence
Only valid changes are made to the supplier master file.
Completeness
Validity
All valid changes to the supplier master file are input and processed.
Completeness
Validity
Changes to the supplier master file are accurate.
Valuation
Changes to the supplier master file are processed in a timely manner.
Completeness
Validity
Supplier master file data remain up-to-date.
Completeness
Validity
Figure 25—Application Control Objectives for the Inventory Cycle
Illustrative Control Objectives
Financial Statement Assertions
Adjustments to inventory prices or quantities are recorded promptly and in
the appropriate period.
Validity
Completeness
Valuation
Occurrence
Adjustments to inventory prices or quantities are recorded accurately.
Valuation
Raw materials are received and accepted only if they have valid purchase
orders.
Validity
Raw materials received are recorded accurately.
Valuation
All raw materials received are recorded.
Completeness
Receipts of raw materials are recorded promptly and in the appropriate
period.
Valuation
Occurrence
Defective raw materials are returned promptly to suppliers.
Validity
All direct and indirect expenses associated with production are recorded
accurately and in the appropriate period.
Valuation
Occurrence
Completeness
Valuation
Occurrence
All transfers of completed units of production to finished goods inventory
are recorded completely and accurately in the appropriate period.
Valuation
Completeness
All transfers of raw materials to production are recorded accurately and in
the appropriate period.
© Copyright IT Governance Institute 2004 29
Illustrative Control Objectives
Finished goods returned by customers are recorded completely and
accurately in the appropriate period.
Finished goods received from production are recorded completely and
accurately in the appropriate period.
Financial Statement Assertions
Valuation
Completeness
Occurrence
Completeness
Valuation
Occurrence
All shipments are recorded.
Validity
Shipments are recorded accurately.
Valuation
Shipments are recorded promptly and in the appropriate period.
Valuation
Occurrence
Inventory is reduced only when goods are shipped with approved customer
orders.
Completeness
Validity
Costs of shipped inventory are transferred from inventory to cost of sales.
Validity
Valuation
Costs of shipped inventory are accurately recorded.
Valuation
Amounts posted to cost of sales represent those associated with shipped
inventory.
Completeness
Validity
Costs of shipped inventory are transferred from inventory to cost of sales
promptly and in the appropriate period.
Valuation
Occurrence
Only valid changes are made to the inventory management master file.
Validity
Completeness
All valid changes to the inventory management master file are input and
processed.
Validity
Completeness
Changes to the inventory management master file are accurate.
Valuation
Changes to the inventory management master file are promptly processed.
Validity
Completeness
Inventory management master file data remain up-to-date.
Completeness
Validity
Figure 26—Application Control Objectives for the Asset Management Cycle
Illustrative Control Objectives
Financial Statement Assertions
Fixed asset acquisitions are accurately recorded.
Valuation
Fixed asset acquisitions are recorded in the appropriate period.
Valuation
Occurrence
All fixed asset acquisitions are recorded.
Completeness
Depreciation charges are accurately calculated and recorded.
Valuation
All depreciation charges are recorded in the appropriate period.
Validity
Valuation
© Copyright IT Governance Institute 2004 30
Illustrative Control Objectives
Financial Statement Assertions
Occurrence
Completeness
All fixed asset disposals are recorded.
Validity
Fixed asset disposals are accurately calculated and recorded.
Valuation
Fixed asset disposals are recorded in the appropriate period.
Valuation
Occurrence
Records of fixed asset maintenance activity are accurately maintained.
Completeness
Fixed asset maintenance activities records are updated in a timely manner.
Completeness
Only valid changes are made to the fixed asset register and/or master file.
Completeness
Validity
All valid changes to the fixed asset register and/or master file are input and
processed.
Completeness
Validity
Changes to the fixed asset register and/or master file are accurate.
Valuation
Changes to the fixed asset register and/or master file are promptly
processed.
Completeness
Validity
Fixed asset register and/or master file data remain up-to-date.
Completeness
Validity
Figure 27—Application Control Objectives for the Human Resources Cycle
Illustrative Control Objectives
Financial Statement Assertions
Additions to the payroll master files represent valid employees.
Validity
All new employees are added to the payroll master files.
Completeness
Terminated employees are removed from the payroll master files.
Validity
Employees are terminated only within statutory and union requirements.
Completeness
Deletions from the payroll master files represent valid terminations.
Completeness
All time worked is input.
Completeness
Time worked is accurately input and processed.
Valuation
Payroll is recorded in the appropriate period.
Valuation
Occurrence
Payroll (including compensation and withholdings) is accurately calculated
and recorded.
Valuation
© Copyright IT Governance Institute 2004 31
Illustrative Control Objectives
Financial Statement Assertions
Payroll is disbursed to appropriate employees.
Validity
Only valid changes are made to the payroll master files.
Validity
Completeness
All valid changes to the payroll master files are input and processed.
Validity
Completeness
Changes to the payroll master files are accurate.
Valuation
Changes to the payroll master files are processed in a timely manner.
Validity
Completeness
Payroll master file data remain up-to-date.
Validity
Completeness
Only valid changes are made to the payroll withholding tables.
Validity
Completeness
All valid changes to the payroll withholding tables are input and processed.
Validity
Completeness
Changes to the payroll withholding tables are accurate.
Valuation
Changes to the payroll withholding tables are promptly processed.
Validity
Completeness
Payroll withholding table data remain up-to-date.
Validity
Completeness
© Copyright IT Governance Institute 2004 32
References
“An Audit of Internal Control Over Financial Reporting Performed in Conjunction with an Audit of
Financial Statements,” Public Company Accounting Oversight Board, Final Auditing Standard:
Release No. 2004-001, USA, 9 March 2004
COBIT, IT Governance Institute, Rolling Meadows, Illinois, USA, July 2000
Committee of Sponsoring Organizations of the Treadway Commission (COSO), www.coso.org
Common Criteria and Methodology for Information Technology Security Evaluation, CSE (Canada),
SCSSI (France), BSII (Germany), NLNCSA (Netherlands), CESG (United Kingdom), NIST (USA)
and NSA (USA), 1999
Exposure Draft Enterprise Risk Management Framework, Committee of Sponsoring Organizations of the
Treadway Commission (COSO), USA, July 2003
“Final Rule: Management's Reports on Internal Control Over Financial Reporting and Certification of
Disclosure in Exchange Act Periodic Reports,” Release Nos. 33-8238; 34-47986; IC-26068; File Nos.
S7-40-02; S7-06-03, US Securities and Exchange Commission, USA, June 2003,
www.sec.gov/rules/final/33-8238.htm
Internal Control—Integrated Framework, Committee of Sponsoring Organizations of the Treadway
Commission (COSO), American Institute of Certified Public Accountants, USA, 1992
ISO IEC 17799, Code of Practice for Information Security Management, International Organization for
Standardization (ISO), Switzerland, 2000
IT Infrastructure Library (ITIL), British Office of Government Commerce (OCG), Central Computer and
Telecommunications Agency (CCTA), London, 1989
Moving Forward–A Guide to Improving Corporate Governance Through Effective Internal Control,
Deloitte Touche, 2003
“Taking Control, A Guide to Compliance with Section 404 of the Sarbanes-Oxley Act of 2002,” Deloitte
& Touche, 2003
“The Defining Issues—Implications of Proposed Auditing Standard on Internal Control,” KPMG, 2003
“The Sarbanes-Oxley Act of 2002, Strategies for Meeting New Internal Control Reporting Challenges,”
PricewaterhouseCoopers, 2003
“The Sarbanes-Oxley Act of 2002, The Current Landscape—Rules, Updates and Business Trends,” Ernst
& Young, 2003
“Understanding the Independent Auditor’s Role in Building Trust,” PricewaterhouseCoopers, 2003
© Copyright IT Governance Institute 2004 33